Summary

Vulnerability Details

In TokenDivider::buyOrder, the caller indicates the desired order with its index, instead of its own properties, like amount or pegged NFT address. In addition, upon the execution of a buy order, the array with sell orders is updated.

This opens the door for front-running attacks. For example, an attacker could see the selected index by the victim, and send another buy order, so that to change the order of array elements in detriment to the victim. Or to their own advantage - by submitting an unfavourable sell order themselves and later front-running another user into buying it..

Impact

Users can't safely buy orders for ERC20 tokens.

Tools Used

logic

Recommendations

User should input additional order properties, like amount and address of the ERC20, which should be validated in the beginning of the function.